Exhibit B - Security Requirements Response_S-10700-00017534.docx
DOCX document 19 KB Posted
- Solicitation number
- S-10700-00017534
- Issued by
- Oregon
About this file
This is a Security Requirements Response Exhibit for RFP S-10700-00017534, issued by the State of Oregon's Department of Administrative Services, State Procurement Services on behalf of Enterprise Information Services for a Secure Service Edge (SSE) Solution. The RFP solicits proposals for a comprehensive security-compliant SSE solution that meets the State's technical, security, and operational requirements. Proposers must demonstrate capacity to meet all specified state information security standards and provide a detailed statement outlining their security compliance capabilities.
Proposers must comply with Oregon's Statewide Information Technology Control Standards requiring security controls meeting or exceeding "Moderate" level standards per NIST SP 800-53, and may demonstrate compliance through current GovRAMP Authorization status or equivalent documentation. All proposer staff with access to State systems, facilities, and confidential information must submit to security checks including fingerprinting, LEDS, and FBI CJIS background checks. Proposers must comply with the Statewide Policy on Cyber and Information Security (DAS Policy 107-004-052), including restrictions on offshore and foreign services. If offshore or foreign services are included in the proposal, detailed justification is required including geographic locations, benefits to the State, protective systems and controls, and steps to achieve full policy compliance. Additionally, proposers must sign non-disclosure agreements and maintain protection of all State of Oregon sensitive and confidential information throughout the contract term.
View the file
Other files
Show all 14
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
RFP S-10700-00017534 Secure Service Edge (SSE) Solution Exhibit B Security Requirements Response Proposer shall submit a statement addressing its capacity to meet State information security requirements. The statement must reflect the information indicated in this section, and clearly demonstrate that if awarded a Contract:
| 1. | Proposer and Proposer's staff monitoring its systems who will have access to State systems, facilities, and confidential information shall submit to all security checks requested by the State, which may include any combination of fingerprinting, Oregon Law Enforcement Data Systems (“LEDS”) and Federal Bureau of Investigation Criminal Justice Information Services (“FBI CJIS”) background checks. |
| 2. | Proposer shall comply with the Statewide Information Technology (IT) Control Standards found online at Enterprise Information Services: Guidance for State Agencies: Cyber Security Services: State of Oregon, specifically: |
| • | Oregon’s Statewide Information Technology (IT) Control Standards, by ensuring it maintains security controls that meet or exceed “Moderate” security controls in the National Institute of Standards and Technology (“NIST”) Special Publication (SP) 800-53. |
| • | Oregon’s Statewide Information Technology (IT) Control Standards. Proposer may (but is not required to) provide one of the following to demonstrate compliance with Oregon’s Information Technology Control Standards or industry equivalent standards: Proof of current GovRAMP Authorized status (Ready, Provisionally Authorized, or Authorized) in the form of a GovRAMP Letter, or documentation of a valid GovRAMP Security Snapshot Score. |
| • | Oregon’s Statewide Information Security Program Plan. |
| 3. | Proposer shall comply with the Statewide Policy on Cyber and Information Security, DAS Statewide Policy 107-004-052, found online at: https://www.oregon.gov/das/Pages/policies.aspx#IT, pertaining to State systems and security, including its restrictions on offshore and foreign services. |
Proposer’s response to this section must specifically address its capacity to meet the policy’s restriction on offshore and foreign services for the duration of the Contract. State if fully compliant services and personnel are available, and part of Proposer’s Proposal. If the Proposal includes optional or necessary offshore or foreign services, Proposer must include in its Proposal a statement describing:
| 1. | The offshore and/or foreign services that Proposer intends to use to deliver the Solution and Services. |
| 2. | Proposer to provide the geographic location of where services are to be performed. |
| 3. | The benefit to the State of the offshore and/or foreign services. |
| 4. | That Proposer will ensure it has systems and controls in place that will protect Agency Data and the State’s networks in the event offshore or foreign services are allowed, and what systems and controls Proposer expects the State to have in place. |
| 5. | What steps Proposer is willing and able to take to fully meet the policy’s restrictions on offshore and foreign resources. Describe any additional steps Agency would be requested to take, and any additional costs Agency may incur if Proposer provided the System and Services using fully compliant services. |
| 4. | As necessary, Proposer shall sign a non-disclosure agreement regarding information received or processed on its equipment from the State of Oregon. |
| 5. | Proposer shall protect at all times State of Oregon sensitive and confidential information. |
File details come from the government source that posted it. Updated .